FROM git.aridgwayweb.com/armistace/beer_base_image AS flask

COPY requirements.txt .

ADD src /beer_data/src

# The app lives in src/flask and imports its siblings by bare name
# (``import brewing``), so that directory is the working directory.
WORKDIR /beer_data/src/flask

# Run as an unprivileged user.  The app only needs to read its own source
# and talk to Mongo over the network — it writes no files — so it does not
# need to be root.
RUN useradd --system --create-home --home-dir /home/beer --shell /usr/sbin/nologin beer \
    && chown -R beer:beer /beer_data

# The app is served by waitress, not the Flask development server.
# FLASK_DEBUG stays OFF: the old entrypoint ran the Werkzeug debugger in
# production, which exposes an interactive console on any unhandled error.
ENV FLASK_ENV=production
ENV FLASK_DEBUG=0
ENV PORT=5000

# SECRET_KEY MUST be supplied by the deployment (see RUNBOOK.md).  There is
# deliberately no default: the app refuses to start without a real one, so a
# misconfigured deployment fails loudly instead of running with a known
# session-signing key.
# ENV SECRET_KEY=...

USER beer

EXPOSE 5000

ENTRYPOINT ["python", "-m", "waitress", "--listen=0.0.0.0:5000", "--call", "beer_data:create_app"]